SOC Analyst
Job Description
Essential Functions:
• Develop moderately complex security designs and test plans using existing technology.
• Perform and document root cause analysis for security incidents.
• Perform and document vulnerability analyses
• Develop cyber security analytics and threat intelligence using multiple data sources provided to the Security Information and Event Management (SIEM) system.
• Create relevant documentation and recommendations for changes to the current security architecture.
• Drive the capabilities and execution to effectively optimize and improve enterprise security.
• Demonstrate expert level knowledge of security services and implementations.
• Investigate, positively identify, and document anomalous events and incidents that are escalated by Tier 1 engineers.
• Document and escalate appropriate events and incidents to Tier 3 engineer.
• Examine cyber adversary techniques in order to develop defensive methodologies.
• Conduct risk analysis and convert it into actionable monitoring recommendations to be conducted by the SOC.
• Conduct vulnerability assessments and recommend remediation and mitigation strategies and implementations to ensure effective achievement of the organizational objectives.
• Provide support for security incidents throughout the incident lifecycle as needed and make recommendations to ensure enterprise infrastructure is protected.
• Perform analyses to validate established security requirements and to recommend additional security requirements and safeguards.
VENDORS/TOOLS/MANAGEMENT SYTEMS
• Wireshark
• LogRhythm
• ServiceNow
• Keylight
• Nessus/Tenable
• Sourcefire
• Cylance
• Zscaler
• Data Loss Prevention
REQUIRED QUALIFICATIONS & EXPERIENCE
• Bachelor degree in Computer Science, Engineering, Information Technology, Cybersecurity or related field and a minimum of five years of experience in Cyber Security.
• Must be able to meet all Law & Justice and departmental clearance requirements prior to starting work and be eligible to pass law enforcement level background investigations and obtain U.S. SECRET (or similar) clearances as required.
• Demonstrated Experience with Cyber Intelligence & Vulnerability Assessment including expert experience in at least two of the following areas:
(a) Vulnerability Assessment;
(b) Intrusion Prevention and Detection;
(c) Access Control and Authorization;
(d) Policy Enforcement;
(e) Application Security;
(f) Protocol Analysis;
(g) Firewall Management;
(h) Incident Response;
(i) Encryption;
(j) Web-filtering;
(k) Advanced Threat Protection
Skills Required
Vulnerability Assessment,Application Security,Firewall Management,Threat Protections,Wireshark, Logrythm, Nessus